Search
Find a vulnerability
Search criteria
4 vulnerabilities found for PureBlog by kevquirk
CVE-2026-124636 (GCVE-0-2026-124636)
Vulnerability from nvd – Published: 2026-11-09 14:15 – Updated: 2026-11-09 22:34 X_Open Source
VLAI
EPSS
VEX
Title
kevquirk PureBlog Page Editor content.php save_page path traversal
Summary
A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack is possible. Upgrading to version 3.7.3 is sufficient to fix this issue. The patch is named 71f5b0de2ecb2bb2934048ed40e1155c107484e3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:34 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433066 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433066/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124636 | third-party-advisory |
| https://vuldb.com/submit/1040559 | third-party-advisory |
| https://github.com/kevquirk/pureblog/issues/87 | issue-tracking |
| https://github.com/kevquirk/pureblog/commit/71f5b… | patch |
| https://github.com/kevquirk/pureblog/releases/tag… | patch |
| https://github.com/kevquirk/pureblog/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124636",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:34:21.230851Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:34:31.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kevquirk:pureblog:*:*:*:*:*:*:*:*"
],
"modules": [
"Page Editor"
],
"product": "PureBlog",
"vendor": "kevquirk",
"versions": [
{
"status": "affected",
"version": "3.7.0"
},
{
"status": "affected",
"version": "3.7.1"
},
{
"status": "affected",
"version": "3.7.2"
},
{
"status": "unaffected",
"version": "3.7.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "summmm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack is possible. Upgrading to version 3.7.3 is sufficient to fix this issue. The patch is named 71f5b0de2ecb2bb2934048ed40e1155c107484e3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.7,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:15:20.001Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433066 | kevquirk PureBlog Page Editor content.php save_page path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433066"
},
{
"name": "VDB-433066 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433066/cti"
},
{
"name": "CVE-2026-124636 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124636"
},
{
"name": "Submit #1040559 | kevquirk PureBlog 3.7.2 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040559"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/kevquirk/pureblog/issues/87"
},
{
"tags": [
"patch"
],
"url": "https://github.com/kevquirk/pureblog/commit/71f5b0de2ecb2bb2934048ed40e1155c107484e3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/kevquirk/pureblog/releases/tag/v3.7.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/kevquirk/pureblog/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T09:14:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "kevquirk PureBlog Page Editor content.php save_page path traversal",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124636",
"datePublished": "2026-11-09T14:15:20.001Z",
"dateReserved": "2026-11-09T08:09:13.250Z",
"dateUpdated": "2026-11-09T22:34:31.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124635 (GCVE-0-2026-124635)
Vulnerability from nvd – Published: 2026-11-09 14:00 – Updated: 2026-11-09 14:00 X_Open Source
VLAI
EPSS
VEX
Title
kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload
Summary
A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433065 | vdb-entry |
| https://vuldb.com/vuln/433065/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124635 | third-party-advisory |
| https://vuldb.com/submit/1040557 | third-party-advisory |
| https://github.com/kevquirk/pureblog/issues/86 | issue-tracking |
| https://github.com/kevquirk/pureblog/commit/71f5b… | patch |
| https://github.com/kevquirk/pureblog/releases/tag… | patch |
| https://github.com/kevquirk/pureblog/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kevquirk:pureblog:*:*:*:*:*:*:*:*"
],
"modules": [
"Admin Image Upload Endpoint"
],
"product": "PureBlog",
"vendor": "kevquirk",
"versions": [
{
"status": "affected",
"version": "3.7.0"
},
{
"status": "affected",
"version": "3.7.1"
},
{
"status": "affected",
"version": "3.7.2"
},
{
"status": "unaffected",
"version": "3.7.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "summmm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:00:12.996Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433065 | kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/433065"
},
{
"name": "VDB-433065 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433065/cti"
},
{
"name": "CVE-2026-124635 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124635"
},
{
"name": "Submit #1040557 | kevquirk PureBlog 3.7.2 Unrestricted File Upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040557"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/kevquirk/pureblog/issues/86"
},
{
"tags": [
"patch"
],
"url": "https://github.com/kevquirk/pureblog/commit/71f5b0de2ecb2bb2934048ed40e1155c107484e3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/kevquirk/pureblog/releases/tag/v3.7.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/kevquirk/pureblog/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T09:14:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124635",
"datePublished": "2026-11-09T14:00:12.996Z",
"dateReserved": "2026-11-09T08:08:24.665Z",
"dateUpdated": "2026-11-09T14:00:12.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124636 (GCVE-0-2026-124636)
Vulnerability from cvelistv5 – Published: 2026-11-09 14:15 – Updated: 2026-11-09 22:34 X_Open Source
VLAI
EPSS
VEX
Title
kevquirk PureBlog Page Editor content.php save_page path traversal
Summary
A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack is possible. Upgrading to version 3.7.3 is sufficient to fix this issue. The patch is named 71f5b0de2ecb2bb2934048ed40e1155c107484e3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:34 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433066 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433066/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124636 | third-party-advisory |
| https://vuldb.com/submit/1040559 | third-party-advisory |
| https://github.com/kevquirk/pureblog/issues/87 | issue-tracking |
| https://github.com/kevquirk/pureblog/commit/71f5b… | patch |
| https://github.com/kevquirk/pureblog/releases/tag… | patch |
| https://github.com/kevquirk/pureblog/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124636",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:34:21.230851Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:34:31.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kevquirk:pureblog:*:*:*:*:*:*:*:*"
],
"modules": [
"Page Editor"
],
"product": "PureBlog",
"vendor": "kevquirk",
"versions": [
{
"status": "affected",
"version": "3.7.0"
},
{
"status": "affected",
"version": "3.7.1"
},
{
"status": "affected",
"version": "3.7.2"
},
{
"status": "unaffected",
"version": "3.7.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "summmm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack is possible. Upgrading to version 3.7.3 is sufficient to fix this issue. The patch is named 71f5b0de2ecb2bb2934048ed40e1155c107484e3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.7,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:15:20.001Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433066 | kevquirk PureBlog Page Editor content.php save_page path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433066"
},
{
"name": "VDB-433066 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433066/cti"
},
{
"name": "CVE-2026-124636 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124636"
},
{
"name": "Submit #1040559 | kevquirk PureBlog 3.7.2 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040559"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/kevquirk/pureblog/issues/87"
},
{
"tags": [
"patch"
],
"url": "https://github.com/kevquirk/pureblog/commit/71f5b0de2ecb2bb2934048ed40e1155c107484e3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/kevquirk/pureblog/releases/tag/v3.7.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/kevquirk/pureblog/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T09:14:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "kevquirk PureBlog Page Editor content.php save_page path traversal",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124636",
"datePublished": "2026-11-09T14:15:20.001Z",
"dateReserved": "2026-11-09T08:09:13.250Z",
"dateUpdated": "2026-11-09T22:34:31.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124635 (GCVE-0-2026-124635)
Vulnerability from cvelistv5 – Published: 2026-11-09 14:00 – Updated: 2026-11-09 14:00 X_Open Source
VLAI
EPSS
VEX
Title
kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload
Summary
A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433065 | vdb-entry |
| https://vuldb.com/vuln/433065/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124635 | third-party-advisory |
| https://vuldb.com/submit/1040557 | third-party-advisory |
| https://github.com/kevquirk/pureblog/issues/86 | issue-tracking |
| https://github.com/kevquirk/pureblog/commit/71f5b… | patch |
| https://github.com/kevquirk/pureblog/releases/tag… | patch |
| https://github.com/kevquirk/pureblog/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kevquirk:pureblog:*:*:*:*:*:*:*:*"
],
"modules": [
"Admin Image Upload Endpoint"
],
"product": "PureBlog",
"vendor": "kevquirk",
"versions": [
{
"status": "affected",
"version": "3.7.0"
},
{
"status": "affected",
"version": "3.7.1"
},
{
"status": "affected",
"version": "3.7.2"
},
{
"status": "unaffected",
"version": "3.7.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "summmm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:00:12.996Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433065 | kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/433065"
},
{
"name": "VDB-433065 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433065/cti"
},
{
"name": "CVE-2026-124635 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124635"
},
{
"name": "Submit #1040557 | kevquirk PureBlog 3.7.2 Unrestricted File Upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040557"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/kevquirk/pureblog/issues/86"
},
{
"tags": [
"patch"
],
"url": "https://github.com/kevquirk/pureblog/commit/71f5b0de2ecb2bb2934048ed40e1155c107484e3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/kevquirk/pureblog/releases/tag/v3.7.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/kevquirk/pureblog/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T09:14:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124635",
"datePublished": "2026-11-09T14:00:12.996Z",
"dateReserved": "2026-11-09T08:08:24.665Z",
"dateUpdated": "2026-11-09T14:00:12.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}